Washington data privacy rights and data broker removal (2026)
How to exercise your data privacy rights in Washington, opt out of data brokers, and file a complaint — updated for 2026.
At a glance
- Comprehensive privacy law? No. Your rights come from the statutes below.
- In effect since MHMDA: most provisions effective March 31, 2024 (small businesses June 30, 2024); geofencing ban effective July 23, 2023.
- Your core rights (MHMDA, re: consumer health data) right to confirm/access, right to delete, right to withdraw consent; broad opt-in consent and a separate authorization to sell
- Honors Global Privacy Control? Not required
- Data-broker registry? No
- Enforced by Washington Attorney General (Consumer Protection Act)
What Delist can do for you in Washington
Washington has no comprehensive privacy law in effect. We submit your requests through each broker's own opt-out channel, on your behalf. Many national brokers honor these requests wherever you live, but none is required to by Washington law, so we follow up and re-file rather than assume.
How the three groups work: our authorized-agent framework.
What still protects you
Washington has no comprehensive consumer privacy law, but it has two strong sectoral protections: the My Health My Data Act (RCW 19.373) — covering a very broad definition of consumer health data, with opt-in consent and a rare PRIVATE RIGHT OF ACTION — and a biometric law (RCW 19.375, AG-enforced). For general non-health, non-biometric data, residents rely on breach notification, CCPA-broker opt-outs, and GPC, and cannot compel ordinary businesses to provide access/deletion/opt-out under a comprehensive state law.
Your privacy rights in Washington
- (MHMDA, re: consumer health data) right to confirm/access, right to delete, right to withdraw consent; broad opt-in consent and a separate authorization to sell
How to exercise your rights
Exercise MHMDA rights (confirm/access, delete, withdraw consent) against regulated entities for consumer health data; note the MHMDA's private right of action allows individuals to sue under the WA Consumer Protection Act. For general (non-health) data, residents have no comprehensive access/delete rights and rely on breach notification, CCPA-broker opt-outs, and GPC. Biometric collection is governed by RCW 19.375 (AG-enforced).
Ready to see who's selling your information? Browse our data broker removal guides for step-by-step opt-out instructions.
California DROP
None.
Sensitive information
MHMDA requires separate opt-in CONSENT to collect/share consumer health data and a separate signed AUTHORIZATION to sell it; bans geofencing within 2,000 feet of facilities providing health services. 'Consumer health data' is defined very broadly (includes reproductive/gender-affirming care, biometric data, precise location indicating health-services attempts, and health-related inferences).
Special protections
MY HEALTH MY DATA ACT (RCW 19.373) — the first comprehensive consumer-health-data law, with a PRIVATE RIGHT OF ACTION (via the CPA), broad health-data definition, opt-in consent, sale authorization, and a geofencing ban. Biometric law (RCW 19.375, AG-only). Address Confidentiality Program administered by the WA Secretary of State for DV/stalking/trafficking survivors. No general Daniel's-Law analogue identified (judicial-security measures exist via court rules).
Biometric privacy
Washington biometric privacy law, RCW 19.375 (HB 1493, 2017) — AG-enforced only via the Consumer Protection Act (NO standalone private right of action specific to biometrics, unlike Illinois BIPA). Note: the MHMDA separately gives a private right of action for biometric data that qualifies as 'consumer health data.'
How to file a complaint
Washington Attorney General — https://www.atg.wa.gov/file-complaint
Recent updates (2025–2026)
MHMDA fully in effect since 2024 and generating private litigation — a significant exposure for any entity touching health-adjacent data. The comprehensive Washington Privacy Act remains unpassed as of 2026.
Frequently asked questions
Does Washington have a data privacy law?
Washington has no comprehensive consumer privacy law, but federal rules and data-broker opt-out paths still apply.
How do I remove my information from data brokers in Washington?
Exercise MHMDA rights (confirm/access, delete, withdraw consent) against regulated entities for consumer health data; note the MHMDA's private right of action allows individuals to sue under the WA Consumer Protection Act. For general (non-health) data, residents have no comprehensive access/delete rights and rely on breach notification, CCPA-broker opt-outs, and GPC. Biometric collection is governed by RCW 19.375 (AG-enforced).
Who enforces privacy law in Washington?
Washington Attorney General (Consumer Protection Act); CRITICALLY, the MHMDA is enforceable via a PRIVATE RIGHT OF ACTION through the Washington CPA (RCW 19.86) — one of very few state privacy laws with a private right of action.
Does Washington have a data broker registry?
No. Washington does not have a dedicated data-broker registry, but you can still opt out of brokers directly.
Sources
Also in this state
Find out what data brokers know about you
A free scan shows which sites are exposing your name, phone, address and email, and Delist files the removals for you.